Researchers found 35,578 Grok-built apps open to anyone, 24 of them made by SpaceXSI staff

On November 10, 2026, security firm Claroc published research showing that most apps built with Grok, the AI assistant from SpaceXSI, were open to anyone who found their address. Of the 37,571 apps still online when Claroc tried them, 35,578 opened with no sign-in. Grok's Build mode writes an app from a description typed into the chat and publishes it at its own address under grok.me.

What was exposed

Claroc estimates that about one open app in ten held sensitive business or personal data. Among the apps it confirmed by hand were a hospital group's roster of more than 3,500 employees, an intensive care briefing on a single patient, and a contractor's timesheet whose code held every employee's password in plain text.

SpaceXSI and X staff had built 24 of the open apps. They included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and advertising proposals, one of them addressed to an American federal agency. Claroc also identified internal data from 30 other organizations, 26 of them with more than 1,000 employees and six in the Fortune 500. It names none of them.

How the addresses were found

Every published Grok app gets its own hostname under grok.me. When someone opens it, their computer asks a DNS server where that name lives, and commercial passive DNS services store such lookups in databases that anyone with an account can search. Claroc says subdomain discovery listed 43,601 names under grok.me.

Claroc points out that shared chats in Claude, ChatGPT, and Gemini keep the secret part of the link in the path after the domain, so DNS never sees it. It adds that Lovable, Replit, v0, Bolt, and other app builders also give each app its own hostname.

The disputed default

In the paid account Claroc used, the panel that opens on Publish offered three access settings: Anyone with the link, Invited users, and Only you. Anyone with the link was already selected.

SpaceXSI told reporters that apps are private until their creator chooses to share one, that publishing takes several steps, and that employee accounts default to Only you. Claroc agrees that nothing goes public before Publish is clicked, but says the owners of the 35,578 open apps went through every one of those steps.

In a team app Claroc built for the test, the sign-in code Grok wrote added any Google account to the team before checking whether it belonged there. An uninvited account then read, changed, and deleted records. Claroc says it ran this test only on its own apps.

Claroc reported the issue to SpaceXSI on November 8, 2026. Both Claroc and Ars Technica say SpaceXSI has since taken down the 24 staff apps, but not the apps of other users. Claroc has started notifying the affected organizations itself.